1. TEL2813/IS2820 Security Management Protection Mechanisms, (Access Control, IDS, Auditing, Vulnerability) Lecture 6 Feb 19, 2008

2. Objectives • Know/Understand/Define various protection mechanisms • Access Control and Authentication • IDS and Auditing • Know/Understand Vulnerability classifications

3. Sphere of Security Defense in Depth

4. Introduction (Continued) • Some of the most powerful and widely used technical security mechanisms include: • [Authentications and] Access controls • Firewalls • Dial-up protection • Intrusion detection systems • Auditing, Scanning and Analysis Systems • Vulnerability Classification/Assessment Tools • Cryptography Defense in Depth

5. Access Control Devices • Access control encompasses two processes: • Confirming identity of entity accessing a logical or physical area (authentication) • Determining which actions that entity can perform in that physical or logical area (authorization) • A successful access control approach (for both physical access or logical access) always consists of • authentication and • authorization

6. Authentication Mechanisms • Mechanism types: • Something you know • Something you have • Something you are • Something you produce • Strong authentication uses at least two different authentication mechanism types • Two factor authentication • Have + Know

7. Something You Know • Authentication mechanism based on the user’s identity • password, passphrase, or other unique code • A good rule of thumb • passwords be at least eight characters long and contain at least one number and one special character • Attack against password • Dictionary, brute force, man-in-the-middle, social engineering; keyboard attack

8. Password Power (1) Based on Pentium 4 performing 8 million guesses per second

9. Something You Have • Authentication mechanism based on what user has • a card, key, or token • dumb card (such as an ATM cards) with magnetic stripes • smart card containing a processor • Cryptographic token, a processor in a card that has a display • Tokens may be either • synchronous or • Synchronized with the server • Asynchronous • Challenge response

10. Something You Are • Biometric • something inherent in the user • Fingerprints, palm scans, hand geometry/topology, facial recognition, retina scan, iris scan • Most of the technologies that scan human characteristics convert these images to obtain some form of minutiae — • unique points of reference that are digitized and stored in an encrypted format

11. Something You Do • Uses something the user performs or produces • signature recognition and • voice recognition (voice phrase) • Key stroke pattern • Timing for known sequence of keystrokes

12. Authorization • Authorization for each authenticated user • System performs authentication process to verify specific entity • Grants access to resources for only that entity • Authorization for members of a group • System matches authenticated entities to a list of group memberships • Grants access to resources based on group’s access rights • Authorization across multiple systems • Central authentication and authorization system verifies entity identity • Grants a set of credentials to verified entity

13. Evaluating Biometrics • False reject rate: • Percentage of authorized users who are denied access (Type I Error) • False accept rate: • Percentage of unauthorized users who are allowed access (Type II Error) • Crossover error rate: • Point at which the number of false rejections equals the false acceptances

14. Orders of Effectiveness and Acceptance

15. Managing Access Controls • To appropriately manage access controls, an organization must have a formal access control policy in place • Determines how access rights are granted to entities and groups • Must include provisions for periodically reviewing all access rights, granting access rights to new employees, changing access rights when job roles change, and revoking access rights as appropriate • All those access control models !!! • ACM, SPM, BLP, Biba, Lipner, Clark-Wilson, RBAC

16. Perimeter Defense • Organization system consists of a network of many host machines – • the system is as secure as the weakest link • Use perimeter defense • Define a border and use gatekeeper (firewall) • If host machines are scattered and need to use public network, use encryption • Virtual Private Networks (VPNs)

17. Perimeter Defense • Is it adequate? • Locating and securing all perimeter points is quite difficult • Less effective for large border • Inspecting/ensuring that remote connections are adequately protected is difficult • Insiders attack is often the most damaging

18. Firewalls • Total isolation of networked systems is undesirable • Use firewalls to achieve selective border control • Firewall • Is a configuration of machines and software • Limits network access • Come “for free” inside many devices: routers, modems, wireless base stations etc. • Alternate: a firewall is a host that mediates access to a network, allowing and disallowing certain type of access based on a configured security policy

19. What Firewalls can’t do • They are not a panacea • Only adds to defense in depth • If not managed properly • Can provide false sense of security • Cannot prevent insider attack • Firewalls act at a particular layer (or layers)

20. What is a VPN? • A network that supports a closed community of authorized users • There is traffic isolation • Contents are secure • Services and resources are secure • Use the public Internet as part of the virtual private network • Provide security! • Confidentiality and integrity of data • User authentication • Network access control • IPSec can be used

21. Tunneling in VPN

22. The Development of FirewallsFirst Generation • Packet filtering firewalls • Are simple networking devices that filter packets by examining every incoming and outgoing packet header • Can selectively filter packets based on values in the packet header, accepting or rejecting packets as needed • Can be configured to filter based on IP address, type of packet, port request, and/or other elements present in the packet

23. Packet Filtering Example Rules

24. Second Generation • Application-level firewalls • often consists of dedicated computers kept separate from the first filtering router (edge router) • Commonly used in conjunction with a second or internal filtering router - or proxy server • Proxy server, rather than the Web server, is exposed to outside world from within a network segment called the demilitarized zone (DMZ) • Application-level firewalls are implemented for specific protocols

25. Third Generation • Stateful inspection firewalls, • keep track of each network connection established between internal and external systems • State tables • can restrict incoming packets by allowing access only to packets that constitute responses to requests from internal hosts • If the stateful inspection firewall receives an incoming packet that it cannot match in its state table, • Defaults to using ACL to determine whether to allow the packet to pass

26. Fourth Generation • Or dynamic packet filtering firewall, • allows only a particular packet with a specific source, destination, and port address to pass through the firewall • Does so by understanding how the protocol functions, and by opening and closing pathways in the firewall • Dynamic packet filters are an intermediate form, between traditional static packet filters and application proxies

27. Firewall Architectures • Each of the firewall generations can be implemented in a number of architectural configurations • Four architectural implementations of firewalls are especially common: • Packet filtering routers • Screened-host firewalls • Dual-homed host firewalls • Screened-subnet firewalls

28. Packet Filtering Routers • Most organizations with an Internet connection use some form of router between their internal networks and the external service provider • to block packets that the organization does not allow into the network • Often lacks auditing and strong authentication • Complexity of the ACLs can grow to the point of degrading network performance

29. Screened-Host Firewall Systems • Screened-host firewall systems • combine packet filtering router with a separate, dedicated firewall such as an application proxy server • allows the router to screen packets to minimize network traffic and load on the internal proxy • Application proxy examines an application layer protocol, such as HTTP, and performs the proxy services • This contains a separate - bastion host • rich target for external attacks, and should be very thoroughly secured

30. Dual-Homed Host Firewalls • In this configuration, the bastion host contains two network interfaces: • One connected to external network • One connected to internal network, • Network–address translation (NAT) is often implemented with this architecture

31. Dual-Homed Host Firewalls (Continued) • These special, non-routable addresses consist of three different ranges: • 10.x.x.x ,> 16.5 million usable addresses • 192.168.x.x ,> 65,500 addresses • 172.16.0.x - 172.16.15.x ,> 4000 usable addresses

32. Screened-Subnet Firewalls (with DMZ) • Screened-subnet firewall • consists of one or more internal bastion hosts located behind a packet filtering router, with each host protecting the trusted network • First general model uses two filtering routers, • with one or more dual-homed bastion hosts between them

33. Screened-Subnet Firewalls (with DMZ) • Second general model (next slide) shows connections are routed as follows: • Connections from the outside or untrusted network are routed through an external filtering router • Connections from the outside or untrusted network are routed into—and then out of—a routing firewall to the separate network segment known as the DMZ • Connections into the trusted internal network are allowed only from the DMZ bastion host servers

34. Managing Firewalls • Any firewall device— • must have its own configuration that regulates its actions • A policy regarding the use of a firewall should be articulated before it is made operable • In practice, configuring firewall rule sets can be a nightmare • Each firewall rule must be carefully crafted, placed into the list in the proper sequence, debugged, and tested

35. Managing Firewalls • Proper rule sequence ensures that • the most resource-intensive actions are performed after the most restrictive ones, thereby reducing the number of packets that undergo intense scrutiny • Firewalls: • Deal strictly with defined patterns of measured observation • Are prone to programming errors, flaws in rule sets, and other inherent vulnerabilities • Are designed to function within limits of hardware capacity - Can only respond to patterns of events that happen in an expected sequence

36. Firewall Best Practices • All traffic from trusted network is allowed out • Firewall device is never accessible directly from public network • Simple Mail Transport Protocol (SMTP) data is allowed to pass through the firewall, but should be routed to a SMTP gateway • All Internet Control Message Protocol (ICMP) data should be denied • Telnet (terminal emulation) access to all internal servers from the public networks should be blocked • When Web services are offered outside the firewall, HTTP traffic should be handled by some form of proxy access or DMZ architecture

37. Dial-Up Protection • Network connectivity using dial-up • usually much simpler and less sophisticated than Internet connections • Usually, simple user name and password schemes are the only means of authentication • War-dialer • Attacker uses to dial-up points • Automatic phone dialing • Notes modems answering

38. RADIUS and TACACS • RADIUS and TACACS: • Remote Authentication Dial-In User Service • Terminal Access Controller Access Control System • Systems that authenticate credentials of users trying to access through dial-up connection • RADIUS • centralizes the management of user authentication • passes the request along with the user’s credentials to the RADIUS server • RADIUS then validates the credentials • TACACS • Is based on a client/server configuration

39. Figure 9-9RADIUS Configuration

40. Managing Dial-Up Connections • Thorny issues: • Determine how many dial-up connections the organization has • Control access to authorized modem numbers • Use call-back whenever possible • Use token-based authentication if at all possible

41. Intrusion Detection

42. Intrusion Detection/Response • Denning: Systems under attack fail to meet one or more of the following characteristics • Actions of users/processes conform to statistically predictable patterns • Actions of users/processes do not include sequences of commands to subvert security policy • Actions of processes conform to specifications describing allowable actions

43. Intrusion Detection • Idea: • Attack can be discovered by one of the above being violated • Practical goals of intrusion detection systems: • Detect a wide variety of intrusions (known + unknown) • Detect in a timely fashion • Present analysis in a useful manner • Need to monitor many components; proper interfaces needed • Be (sufficiently) accurate • Minimize false positives and false negatives

44. Figure 9-10Intrusion Detection Systems

45. Host-Based IDS • Host-based IDS works by configuring and classifying various categories of systems and data files • Unless the IDS is very precisely configured, benign actions can generate a large volume of false alarms • Host-based IDSs can monitor multiple computers simultaneously

46. Network-Based IDS • Network-based IDSs • Monitor network traffic and, when a predefined condition occurs, notify appropriate administrator • Looks for patterns of network traffic • Must match known and unknown attack strategies against their knowledge base to determine whether an attack has occurred • Yield many more false-positive readings than do host-based IDSs • Because attempting to read network activity pattern to determine what is normal and what is not

47. IDS Types:Anomaly Detection • Compare characteristics of system with expected values • Threshold metric: when statistics deviate from normal by threshold, sound alarm • E.g., Number of failed logins • Statistical moments: based on mean/standard deviation of observations • Number of user events in a system • Time periods of user activity • Resource usages profiles • Markov model: based on state, expected likelihood of transition to new states • If a low probability event occurs then it is considered suspicious

48. Statistical Anomaly-Based IDS • Statistical anomaly-based IDS (stat IDS) or behavior-based IDS • First collects data from normal traffic and establishes a baseline • Then periodically samples network activity, based on statistical methods • Compares samples to baseline • When activity falls outside baseline parameters (known as the clipping level), IDS notifies the administrator • Advantage is that system is able to detect new types of attacks • Because it looks for abnormal activity of any type

49. Anomaly Detection:How do we determine normal? • Capture average over time • But system behavior isn’t always average • Correlated events • Events may have dependencies • Machine learning approaches • Training data obtained experimentally • Data should relate to as accurate normal operation as possible

50. IDS Types:Misuse Modeling • Does sequence of instructions violate security policy? • Problem: How do we know all violating sequences? • Solution: capture known violating sequences • Generate a rule set for an intrusion signature • Alternate solution: State-transition approach • Known “bad” state transition from attack • Capture when transition has occurred (user root)